How to create a service that has network admin privileges through the Docker Engine API

I am building a chaos engineering tool for Docker Swarms. I am wanting to use iproute2 so I can inject packet delays into the docker swarm. To do this I need to create a swarm service that has network admin privileges' through the Docker Engine API (v1.43).

I can see that I can create a container with network admin privileges with CapAdd in HostConfig using the NET_ADMIN option (<https://docs.docker.com/engine/api/v1.43/#tag/Container/operation/ContainerCreate>). However in the Docker Engine API documentation for creating a service (<https://docs.docker.com/engine/api/v1.43/#tag/Service/operation/ServiceCreate>) in ContainerSpec there is also CapabilityAdd but there are only 4 options which are "CAP_NET_RAW", "CAP_SYS_ADMIN", "CAP_SYS_CHROOT", "CAP_SYSLOG". There is no NET_ADMIN option. Does anyone have any solutions to this or any workarounds I could use so that I can create a service with NET_ADMIN privileges?

I eventually reached a solution and solved my own problem. In case anyone else has a similar issue, I have explained my solution. It is not shown in the Docker Engine API documentation but to make the service NET_ADMIN, simply use:

"CapabilityAdd" : [
                        "CAP_NET_ADMIN"
                    ]

I believe any of the capabilities listed here in the Linux capabilities documentation can be used (https://man7.org/linux/man-pages/man7/capabilities.7.html). Also if like me you are wanting to interfere with a docker swarm network from inside a container, you should set the network mode to "host", so that you can interact with all the networks running on the host. You can do this as shown below.

    "Networks": [
        {
            "Target": "host"
        }
    ]